CVE-2018-17187 (High) detected in proton-j-0.13.1.jar

[mend-for-github-com[bot]]

CVE-2018-17187 - High Severity Vulnerability

Vulnerable Library - proton-j-0.13.1.jar

Proton is a library for speaking AMQP.

Library home page: http://www.apache.org/

Path to dependency file: /client/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/qpid/proton-j/0.13.1/proton-j-0.13.1.jar,/home/wss-scanner/.m2/repository/org/apache/qpid/proton-j/0.13.1/proton-j-0.13.1.jar,/home/wss-scanner/.m2/repository/org/apache/qpid/proton-j/0.13.1/proton-j-0.13.1.jar

Dependency Hierarchy: - uimaj-as-activemq-2.9.0.jar (Root Library) - activemq-amqp-5.14.0.jar - :x: **proton-j-0.13.1.jar** (Vulnerable Library)

Found in HEAD commit: 9975759c204d49687fbd104a30621d41b8638321

Found in base branch: master

Vulnerability Details

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.

Publish Date: 2018-11-13

URL: CVE-2018-17187

CVSS 3 Score Details (7.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1593018

Release Date: 2018-11-13

Fix Resolution: 0.30.0

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.